EP3741148A1

EP3741148A1 - Method for determining a key for securing communication between a user apparatus and an application server

Info

Publication number: EP3741148A1
Application number: EP19703167.7A
Authority: EP
Inventors: Todor GAMISHEV
Original assignee: Orange SA
Current assignee: Orange SA
Priority date: 2018-01-19
Filing date: 2019-01-11
Publication date: 2020-11-25
Anticipated expiration: 2039-01-11
Also published as: CN111630882B; EP3741148B1; WO2019141924A1; US11895487B2; KR102632519B1; FR3077175A1; JP7301852B2; JP2021510984A; KR20200110345A; CN111630882A; US20200344603A1

Abstract

The invention relates to a method for determining a key for securing communication between a user apparatus (10) and an application server (40). An authentication server (20) of a mobile communication network and the user apparatus generate a secret master key during an authentication procedure. The user apparatus sends the authentication server a request for a key to communicate with the application server and receives a random variable. The authentication server and the user apparatus calculate the requested key by means of a key derivation function applied to at least the random variable, a user identifier and an application server identifier using the master key.

Description

Technique for determining a key for securing communication between a user equipment and an application server

The invention relates to the general field of telecommunications.

The invention relates more particularly to a technique for determining a key intended to secure a communication between a user equipment and an application server.

The technique of determining a key is in the field of mobile communication networks.

In order to allow a UE (User Equipment), also called a terminal, to communicate securely with an application server, a so-called GBA architecture for Generic Bootstrapping Architecture has been defined by the standardization group. 3GPP in the context of a mobile network, for example fourth generation. This architecture is defined in the technical specification referenced 3GPP TS 33.220 version VI 5.1.0, entitled "Generic Authentication Architecture (GAA); Generic Bootstrapping Architecture (GBA) (Release 15) ". In this GBA architecture, there is provided a Bootstrapping Server Function (BSF) that implements terminal authentication and makes it possible to define a master key Ks associated with a boot transaction identifier B_TID ( for "Bootstrapping Transaction Identifier"). Once this master key Ks has been defined, the terminal and the BSF function derive a key Ks_NAF from the master key Ks to secure the exchanges with the application server NAF. Specifically, this key Ks_NAF is derived from the master key Ks by applying a key derivation function KDF (for "Key Derivation Function") to key derivation parameters. These parameters include an identifier of the application server NAF_Id and the random number RAND used during authentication. At the end of these actions, the terminal and the BSF function share a key Ks_NAF intended to be used to secure the exchanges between the terminal and the application server NAF. Fe application server NAF then requests the key Ks_NAF associated with the transaction identifier B_TID BSF function. Fe terminal and the application server NAF can then communicate securely using the key Ks_NAF.

In this context, the mobile network operator is an intermediary who uses the secrets shared between the home subscriber system (HSS) and the security module embedded in the terminal to guarantee the security of the link between the subscriber system. NAF application server and the UE terminal without these two entities need to share a secret.

The introduction of such a GBA architecture into the network of a mobile operator entails significant costs, in particular because of the introduction of this BSF function and its interfacing with the mobile network. In addition, a function similar to this GBA function is not currently provided in the fifth generation mobile network, said 5G, being standardized by the 3GPP group.

One of the aims of the invention is to remedy the shortcomings / disadvantages of the state of the art and / or to make improvements thereto.

According to a first aspect, the subject of the invention is a method for determining a key intended to secure a communication between a user equipment and an application server. The method comprises at the level of the user equipment:

authentication of the user equipment by an authentication server of a mobile communication network, a secret master key being generated during said authentication by the user equipment and the authentication server;

a sending by the user equipment to the authentication server of a key request to communicate with the application server;

a calculation of said key by means of a key derivation function applied to at least one randomness, a user identifier and an identifier of the application server by using the master key, said random having been received by the user equipment the authentication server.

Correlatively, the method for determining a key intended to secure a communication between a user equipment and an application server comprises at the authentication server level:

a reception by the authentication server of a key request sent by the user equipment to communicate with the application server;

- sending by the authentication server to the user equipment of a hazard;

- A calculation of said key by means of a key derivation function applied to at least the random, a user identifier and an identifier of the application server using the master key.

With this technique, the key for securing communication between the user equipment and the application server is derived from a master key generated during an authentication implemented by the authentication server of the communication network. mobile. The technique is thus implemented by an authentication server that is already integrated and therefore interfaced in the mobile communication network, in particular with the user data management server. It is not necessary to provide a specialized server, called boot server, to determine this key. In addition, the calculation of the key is performed independently of the authentication: a random is used to calculate the key independently of that used for authentication. The master key and the derived key are thus decoupled, distinct hazards having been used. It is thus possible to derive as many keys as necessary, provided that the master key is not expired. Once the key is derived, the key remains valid even if the master key has been modified. Secure communication using the calculated key can then be established between the user equipment and the application server.

The various embodiments or features mentioned below may be added independently or in combination with each other, to the method of determining a key as defined above.

In a particular embodiment, the authentication server provides the application server the key that it has calculated.

In a particular embodiment of the method for determining a key, this authentication is triggered during a registration of the user equipment with the mobile communication network.

The proposed technique thus takes advantage of the authentication that has been implemented when registering the user equipment with the mobile communication network. Indeed, in the authentication procedure currently being standardized by the 3GPP group for the fifth generation system, noted 5G, defined in the specification document 3GPP TS 33.501 V0.6.0 (2017-12) "Security Architecture and Procedures for 5G System (Release 15) ", a K _AUSF master key is determined by the user equipment and the server implementing the Authentication Server Function (AUSF). For EAP-AKA 'authentication, the K _AUSF master key is determined from an Extended Session Session Key (EMSK). For 5G AKA authentication, the K _AUSF master key is derived from encryption and integrity keys. The specification document TS 33.501, in its current version, in particular in section 6.2.2.1, indicates that the authentication server can store this K _AUSF master key generated between the authentication procedure and the inter-entity key agreement procedures. of the mobile communication network and the user equipment. This same specification document also indicates in paragraph 6.2.1 in an editorial note that when the authentication server stores this K _AUSF master key, the need or not for the user equipment to memorize it is for further study. It is understood that to implement the proposed determination technique K _AUSF master key must be stored by both the authentication server and the user equipment. This K _AUSF master key being used to derive a key intended to secure a communication between a user equipment and an application server, it is not necessary to implement a new authentication procedure specific to this communication with the application server, contrary to what is required in the current GBA procedure. This therefore avoids soliciting the security element of the user equipment each time the user equipment wishes to communicate with an application server. This technique is also simple to implement in a 5 G mobile communication network, to the extent that it is sufficient to integrate a new service with the authentication server. The latter then exposes this new service and can be contacted by an application server to determine the key for securing communication between the user equipment and the application server.

In a particular embodiment of the determination method, the user equipment sends the application server an access request and receives from the application server a proof prepared by the authentication server and intended for the user equipment, a verification of said proof by the user equipment conditioning the sending of the key request.

Correlatively, the authentication server provides the application server with prepared proof for the user equipment, said proof being intended to be sent by the application server to the user equipment in response to an access request sent by the user server. user equipment, a verification of said proof by the user equipment conditioning the sending of the key request to the authentication server.

An authentication token includes for example this proof. This proof, prepared by the authentication server and provided by the application server to the user equipment, allows the latter to verify that the application server is authorized and this before any key derivation at the user equipment. In the current GBA procedure, the user equipment derives the key even before ensuring that the application server is authorized. The latter may not have been authorized by the BSF server and may not have the derived key.

Correlatively, following an access request received from the user equipment, the application server receives prepared proof for the user equipment and sends this proof to the user equipment, a verification of said proof by the user equipment. user equipment conditioning the sending of the key request to the authentication server.

In a particular embodiment, the authentication server verifies that it has calculated a key intended to secure a communication between said user equipment and said application server, said verification conditioning the sending to the user equipment of the hazard.

Thus, the user equipment does not derive a key when the application server has not previously requested the authentication server for this user equipment.

According to a second aspect, the invention relates to a user equipment, arranged to communicate with an application server via a mobile communication network, this equipment comprising:

an authentication module for the user equipment by an authentication server of the mobile communication network, a secret master key being generated during said authentication by the user equipment and the authentication server;

a module sending the user equipment to the authentication server of a key request to communicate with the application server; a module for calculating a key intended to secure a communication between the user equipment and the application server by means of a key derivation function applied to at least one randomness, a user identifier and a server identifier; application using the master key, said random having been received by the user equipment of the authentication server.

The advantages stated for the method of determining a key according to the first aspect can be transposed directly to the user equipment.

This user equipment can of course include in structural terms the various features relating to the method of determining a key as described above, which can be combined or taken separately.

According to a third aspect, the invention relates to an authentication server of a mobile communication network, this authentication server comprising:

an authentication module, designed to authenticate a user equipment, a secret master key being generated during said authentication by the user equipment and the authentication server;

a module for receiving a key request sent by the user equipment for communicating with an application server;

a module for sending by the authentication server to the user equipment of a hazard;

a module for calculating a key intended to secure a communication between the user equipment and the application server, said key being calculated by means of a key derivation function applied to at least one hazard, an identifier of user and an identifier of the application server using the master key.

The advantages stated for the method of determining a key according to the first aspect can be transposed directly to the authentication server.

This authentication server can of course include in structural terms the various characteristics relating to the method of determining a key as described above, which can be combined or taken separately.

According to a fourth aspect, the invention relates to a system for determining a key intended to secure a communication between a user equipment and an application server, this system comprising at least one user equipment according to the second aspect and an authentication server according to the third aspect ..

The advantages stated for the method of determining a key according to the first aspect can be transposed directly to the system for determining a key.

In a particular embodiment, the system further comprises the application server, said application server comprising a communication module, arranged to receive the authentication server said key. According to a fifth aspect, the invention relates to a program for a user equipment, comprising program code instructions intended to control the execution of those of the steps of the method of determining a previously described key implemented by the equipment. user, when this program is executed by this equipment and a recording medium readable by a user equipment on which a program for a user equipment is recorded.

The advantages stated for the method of determining a key according to the first aspect can be transposed directly to the program for a user equipment and to the recording medium.

According to a sixth aspect, the invention relates to a program for an authentication server, comprising program code instructions intended to control the execution of those of the steps of the method of determining a previously described key implemented by the authentication server, when this program is executed by this server and a recording medium readable by a server on which is recorded a program for a server.

The advantages stated for the method of determining a key according to the first aspect can be transposed directly to the program for an authentication server and to the recording medium.

The technique of determining a key intended to secure a communication between a user equipment and an application server will be better understood with the aid of the following description of particular embodiments, with reference to the appended drawings in which:

FIG. 1 represents a mobile communication network in which the method for determining a key in a particular embodiment is implemented; FIG. 2 illustrates steps of a method for determining a key intended to secure a communication between a user equipment and an application server according to a particular embodiment;

Figure 3 shows a user equipment in a particular embodiment;

FIG. 4 represents an authentication server in a particular embodiment;

FIG. 5 represents an application server in a particular embodiment.

FIG. 1 represents a mobile communication network in which the method for determining a key in a particular embodiment is implemented.

This FIG. 1 represents the architecture of the fifth generation system (5 G) in a mobile communication network in the course of standardization, in a case where the user equipment is in its nominal network. It corresponds to Figure 4.2.3-1 of the 3GPP specification document TS 23.501 V2.0.1 (2017-12), entitled "System Architecture for the 5G System; Stage 2 (Release 15) ". This 5G system architecture includes a plurality of network functions, which are more particularly described functionally in section 6 of this specification document TS 23.501. The different acronyms for these network functions are detailed in the Appendix. Only the network functions contributing to the implementation of the method for determining a K _AF key intended to secure a communication between a user equipment UE (for "User Equipment") and an application server AF (for " Function Application ").

Thus, with reference to this FIG. 1, a secure communication must be established between a user equipment 10 and an application server 40 in order to implement an application.

UE user equipment, also called terminal, is arranged to access a mobile communication network, shown in Figure 1. The conventional architecture of such a user equipment usually distinguishes a runtime environment including a suitable operating system for the execution of user applications, a runtime environment responsible for network communications and called "baseband", and a security element (the term usually used is the term "Secure Element"). The security element is of the "Universal Integrated Circuit Card" (UICC) type, or "eUICC" (for embedded or embedded). An example of a security module is a "USIM" card ("Universal Suscriber Identity Module") inserted into a user equipment and used in mobile telephony. The security element is arranged to store and process sensitive data, for example a network access application and associated authentication data (referred to as "credentials" in English), such as keys and cryptographic algorithms. . Such data is intended to be used by an authentication protocol with the network when accessing the latter. No limitation is attached to a user equipment of this type and in another exemplary embodiment, the security element of the user equipment is a secure software area, arranged to process the network access sensitive data. The user equipment is a mobile device, for example a smartphone-type smart terminal, a tablet, etc. The user of the user equipment has subscribed to an operator for a subscription allowing him to access the mobile network of the operator. For this purpose the user equipment 10 comprises security data which constitute a network access profile. A network access profile includes a set of data that provides secure access to the network. More specifically, the access profile comprises at least one identifier of the user equipment 10, an identifier of the network to which it can access through its subscription, and data intended to be used during the authentication phase with the network. , such as an authentication key, usually denoted K. The user equipment 10 accesses the network entities via an access network denoted (R) AN in FIG. 1. This access network comprises base stations, arranged to manage the transmission and the radio reception with the user equipment 10.

This 5G system architecture is service-based. Specifically, architectural elements are defined as network functions that provide their services through interfaces to a development infrastructure common to other network functions that are authorized to use them. A Network Repository Function (NRF) allows each network function to discover the services offered by other network functions. In addition, the function NEF (for "Network Exposure Function") receives information from other network functions according to their exposed capabilities. The NEF stores the received information as structured data using a standardized interface with a unified data repository (UDR).

The mobile communication network comprises in particular a UDM (Unified Data Management) unified data management server, referenced 30. This management server 30 implements in particular the following functionalities:

- generation of 3GPP AKA authentication data (for "Authentication and Key Agreement");

storage and management of a SUPI identifier (for Subscription Permanent Identifier) for each subscriber of the 5 G system;

- access authorization based on subscription data;

- management of the registration of the home network function of the user equipment;

- subscription management.

The mobile communication network also comprises an Authentication Server Function (AUSF) authentication server, referenced 20, adapted to authenticate the user equipments.

In a conventional manner, and for network access purposes, the security module of the user equipment 10 stores an authentication key, usually denoted K, shared with the unified data management server 30. The key of K authentication is intended to be used for the generation of authentication data and to derive keys such as a key K _AUSF , K _seaf , KAMF and keys encryption signaling, data in the user plane, control radio resources and so-called intermediate keys. For example, the key hierarchy is shown in Figure 6.2.1-1 of the 3GPP specification document TS 33.501 V0.6.0 (2017-12) "Security Architecture and Procedures for 5G System (Release 15)". During this authentication procedure a random RAND is used. The master key K _A USF is a secret key shared between the authentication server 20 and the user equipment 10. In the embodiment described, these two devices store this master key K _A USF after a procedure authentication.

For EAP-AKA 'authentication, the K _AUSF master key is determined from an Extended Session Session Key (EMSK) by the user equipment 10 and the authentication server 20. more precisely, paragraph 6.1.3.1 of document TS 33.501 describes more precisely this authentication procedure EAP-AKA '. For an AKA 5G authentication, the master key K _AUSF is determined from CK / IK keys (for "Ciphering Key" and "Integrity Key") by the user equipment 10 and the authentication server 20. The master key K _AUSF is derived from the CK / IK keys, as specified in paragraph A.2 of Annex A of TS 33.501, by implementing a key derivation function KDF (for "Key Derivation Function") to input parameters. For more details, paragraph 6.1.3.2 of document TS 33.501 describes more precisely this 5G AKA authentication procedure.

Subsequently, the KDF key derivation function corresponds to the function specified in the 3GPP specification document TS 33.220 V15.1.0 (2018-01) "Generic Authentication Architecture (GAA); Generic Bootstrapping Architecture (GBA) (Release 15) ". This document notably specifies how to construct for the KDF key derivation function the input string S, which is part of the input parameters with the key concerned.

For the implementation of the proposed method, an UE_AF_comm service is exposed by the authentication server 20, noted for example Nausf_UE_AF_comm (request), in addition to the Nausf_UEAuthentication service. Nausf is the name given to the interface between the AUSF authentication server and other network functions. Similarly, the UE_AF_comm service is exposed by the application server 40, noted for example Naf_UE_AF_comm (UE_ausf_notify). Naf is the name given to the interface between the AF application server and the other functions of the network. The services exposed by the different network functions are detailed in the specification document 3GPP TS 23.502 V2.0.0 (2017-12) "Procedures for the 5G System; Stage 2 (Release 15) ".

The application server 40 can be managed by the operator of the mobile communication network as well as by a third party.

A system 1 for determining a key intended to secure a communication between a user equipment and an application server comprises at least one user equipment 10 and an authentication server 20.

In a particular embodiment, the system 1 further comprises the application server 40. The method for determining a key intended to secure a communication between a user equipment and an application server, implemented by the user equipment 10, the application server 40 and the authentication server 20, will now be described in relation with Figure 2.

We then place in a context of 5G mobile communication network as described above.

An authentication procedure is implemented by the user equipment 10 in a step E1 and by the authentication server 20 in a step G1 during a registration of the user equipment with the mobile communication network. During this authentication procedure, a secret master key K _AUSF is generated by the user equipment 10 and the authentication server 20 from a random RAND1. At the end of step E1, the user equipment 10 stores in a storage memory 105 the generated master key K _AUSF . Correspondingly, at the end of step G1, the authentication server 20 stores in storage memory 205 the master key K _AUSF generated.

The user equipment 10 sends in a step E2 to the application server 40 an access request Ml. This access request Ml comprises in particular:

- information enabling the identification of the communication network (for example the country code of the MCC network - Mobile Country Code - and the mobile network code MNC - Mobile Network Code -),

an identifier of the user equipment UEn _j which has been provided in advance by the operator of the communication network.

This identifier UEn _j is different from the subscriber identifier SUPI but the network operator is arranged to associate this user identifier UEn _j with the subscriber identifier SUPI for a given connection. This user identifier UEn _j is in a particular embodiment allocated by the network operator.

In a particular embodiment, the user identifier UL _n comprises the information making it possible to identify the communication network.

As an illustrative example, the UL _n identifier, takes the form of name.prénom@orange.fr. Such an identifier makes it possible to identify the user equipment and to identify the operator Orange. It is then possible to deduce the network identifier MCC 208 and MNC 01.

This message Ml is received by the application server 40 in a step F1. Still during this step F1, the application server 40 determines the network identifier and sends a request M2 to the authentication server 20 of the communication network. identified operator, via the server in charge of the NEF exposure function if necessary. This request M2 comprises in particular an identifier of the application server AFn _j and optionally a required validity period ExpireTime ^. The identifier of the application server AI ^; _n , for example, corresponds to "service.fr". This request M2 is received by the authentication server 20 in a step G2. Still in this step G2, the authentication server 20 calculates a key K _AF intended to secure the communication between the user equipment 10 and the application server 40 by means of the key derivation function KDF applied from the master key K _A USF- The input string S comprises in particular the user _ID UE _ID , a validity period ExpireTime _A us _F , an identifier of the application server AF _n , and a random RAND2. The latter is chosen by the authentication server 20 and has no link with the random RAND1 used during the authentication procedure. The ExpireTime _AUSF validity period is determined by the authentication server 20.

Still in this step G2, the authentication server 20 prepares an AF authentication token _autn , including the identifier of the application server AF _n) and a proof P to the user equipment. This proof P corresponds to the result of a function f using as input the master key K _AUSF , the application server identifier AF _n) and the validity period ExpireTime _AUSF :

P = f (K _AUSF AF _ro , ExpireT ime _AUSF ).

This function f is chosen to protect against a replay.

Thus, the authentication token AF _AUTN corresponds to AF _n , Il f (K _AUSF, AF _n _,. ExpireTime _AUSF ) where II corresponds to the concatenation operator. In this authentication token, the application server identifier AFn _j is in clear.

The authentication server 20 then stores in association with the master key K _AUSF and the subscriber identifier SUPI, in particular the user _ID UE _ID and the application server identifier AFn _j .

Then, the authentication server 20 notifies the application server 40 by a message M3 comprising the key K _AF and the authentication token AF _autn . Thus, the authentication server 20 provides the application server 40 with the calculated key K _AF and the proof prepared for the user equipment 10, this proof being intended to be sent by the application server 40 to the user equipment 10. response to the access request Ml sent by the user equipment. In a particular embodiment, the message M3 includes the ExpireT validity period _AUSF .

This message M3 is received by the application server 40 in a step F2. In a particular embodiment, the application server 40 derives two keys K _AFenc for the encryption and K _AFmt for integrity protection from K _AF -

In this step F2, the application server 40 sends a message M4 to the user equipment 10 in response to the access request Ml received in step F1. This message M4 includes in particular the authentication token AFAUTN as well as, if applicable, the validity period ExpireTime _A us _F · It is emphasized here that the exchanges between the user equipment 10 and the server application 40 are protected by network keys, because the user equipment 10 is authenticated to the network.

In a step E3, the user equipment 10 receives the message M4 and verifies the proof of the authentication token AF _A UTO- This proof allows the user equipment 10 to verify that the application server 40 identified has been in relation with the authentication server 20 and that it has the key K _AF · This makes it possible to verify that the application server 40 is authorized and this before any key derivation at the user equipment 10. The verification of the proof by the user equipment 10 conditions the sending of the K _AF key request to the authentication server 20.

When the proof is not satisfied, the user equipment 10 terminates the method for determining a key K _AF .

When the proof is verified as compliant, in a step E4, the user equipment 10 sends the authentication server 20 a key request message M5 to communicate with the application server 40. This message M5 notably comprises its user identifier UE. ^ and the application server identifier LI ^; _P. It is emphasized here that the exchanges between the user equipment 10 and the authentication server 20 are protected by network keys, since the user equipment 10 is authenticated to the network.

This key request message M5 is received by the authentication server 20 in a step G3. The authentication server then verifies that it has already calculated a K _AF key for securing the communication between the user equipment 10 and the application server 40 with the information stored in step G2. This verification conditions the sending to the user equipment 10 of the hazard RAND2. When the check is negative, the authentication server 20 terminates the method of determining a key. When the verification is positive, the authentication server 20 sends a response message M6 to the user equipment 10. This message M6 comprises in particular the user identifier UE ^, the validity period ExpireTime _A us _F, the application server identifier LI ^; _P and the random RAND2 that was used by the authentication server 20 to calculate the key K _A F-

In a step E5, the user equipment 10 receives the message M6 and calculates the key K _AF by derivation of the master key K _A USF in the manner described in Step G2 to the authentication server 20. In one mode of particular embodiment, the user equipment 10 derives two keys KAFenc for encryption and KAH _U I for integrity protection from the key KAF ·

Thus, at the end of this step E5, the user equipment 10 has calculated a key K _AF intended to secure a communication with the application server 40. The latter also has this key K _AF obtained from the authentication server. The determination of this key has been made without performing new authentication, so without requesting the security element of the user equipment again. A communication is then established between the user equipment 10 and the application server 40 secured by means of the key K _AF, limited if necessary by the validity period of ExpireTime _A us _F · Thus, this determination method integrates with a method of establishing a secure communication between a user equipment and an application server.

If the master key K _A USF is modified following a new authentication, there is no impact for the secure communication because the key K _AF is decoupled from the master key K _AUS F-

A key K _AI can thus be determined for each communication with an application server.

The integration of this service in the authentication server and the application server is easy because of the new 5G architecture based on services. A new service Nausf_UE_AF_comm (request) is created on the authentication server. The method thus relies on an existing authentication server and is therefore already integrated in the network of the operator. This method can thus be more easily implemented than the prior art GBA. This method is also easily implemented at the level of the user equipment. A service Naf_UE_AF_comm (UE_ausf_notitfy) is created on the application server. There is no exchange between the authentication server and the unified data management server UDM for the implementation of the method, which relies on an authentication that has already been executed. The cost of deploying such a method is thus low.

The described embodiment comprises a preparation by the authentication server of a proof intended for the user equipment. This proof is provided by the application server to the user equipment and verified by the latter. The preparation of such proof and its verification are not implemented in another particular embodiment.

The described embodiment defines input parameters of the key derivation function. It is emphasized here that in some embodiments, some of these parameters may be absent or else other parameters may be added.

It is understood that this technique of determining a key simplifies the procedure for securing communication between a user equipment and an application server. Once the user equipment authenticated with the authentication server of its mobile network operator, it is easy to determine this key by removing the constraints of the prior art GBA. The integration of this technique into a 5 G mobile communication network is also facilitated.

No limitation is attached to these various embodiments and the skilled person is able to define others to determine this key based on a shared master key between the authentication server and the server. user equipment according to a hazard distinct from that used in the authentication procedure. Figure 3 schematically illustrates a user equipment 10 in a particular embodiment.

The user equipment 10 comprises in particular:

a processor 100 for executing software module code instructions;

a communication module 101, forming a communication interface with a mobile communication network, arranged to communicate with devices of a communication network, for example with an authentication server and an application server;

a memory zone 105, arranged to store a program which comprises code instructions for implementing steps of the determination method;

a storage memory 106, arranged to store data used during the implementation of the determination method;

a security element, not shown in FIG.

The user equipment also includes:

an authentication module 102 of the user equipment by an authentication server 20 of the mobile communication network, a secret master key being generated during said authentication by the user equipment and the authentication server;

a calculation module 103 of a key intended to secure a communication between the user equipment and the application server by means of a key derivation function applied to at least one randomness, a user identifier and an identifier of the key; application server using the master key, said hazard having been received by the user equipment of the authentication server;

a connection module 104, arranged to establish a secure communication with an application server 40 by means of a key K _AF

The communication module 101 is in particular arranged to send the authentication server a key request to communicate with the application server.

The storage memory 106 is in particular arranged to store the master key K _AUSF determined during an authentication procedure. In a particular embodiment, this authentication procedure is triggered during a registration of the user equipment with the mobile communication network.

In a particular embodiment, the communication module 101 is arranged in particular to send the application server an access request and to receive from the application server a proof prepared by the authentication server and intended for the user equipment. The calculation module 103 is then arranged to verify this evidence, this verification conditioning the sending of the key request.

In a particular embodiment, the calculation module 103 is designed to derive two K _AFenc keys for encryption and K _AHUI for integrity protection from K _AF. It is emphasized here that the user equipment 10 also comprises other processing modules, not shown in FIG. 3, arranged to implement the various functions of this user equipment.

Figure 4 schematically illustrates an authentication server 20 in a particular embodiment.

The authentication server 20 of a mobile communication network comprises in particular:

a processor 200 for executing code instructions of software modules;

a communication module 201, forming a communication interface with a mobile communication network, arranged to communicate with devices of a communication network, for example with a user equipment and an application server;

a memory zone 204, arranged to store a program which comprises code instructions for implementing steps of the determination method;

a storage memory 205, arranged to store data used during the implementation of the determination method.

The authentication server 20 also comprises:

an authentication module 202, designed to authenticate a user equipment, a secret master key being generated during said authentication by the user equipment and the authentication server;

a module 203 for calculating a key intended to secure a communication between the user equipment and an application server, said key being calculated by means of a key derivation function applied to at least one random element, an identifier of user and an identifier of the application server using the master key.

The communication module 201 is in particular arranged to receive a key request sent by the user equipment to communicate with an application server and to send to the user equipment a random. The communication module 201 is also arranged to provide the application server with the calculated key.

The storage memory 205 is in particular arranged to store the master key K _AUSF determined during an authentication procedure. In a particular embodiment, this authentication procedure is triggered during a registration of the user equipment with the mobile communication network.

In a particular embodiment, the calculation module 203 is in particular arranged to prepare a proof for the user equipment. The communication module 201 is then arranged to provide this proof to the application server, so that the latter sends it to the user equipment in response to an access request sent by the user equipment, a verification of this proof by the user equipment conditioning the sending of the key request to the authentication server.

In a particular embodiment, the storage memory 205 is arranged to store in association with the master key K _A USF and the subscriber identifier SUPI, in particular the user _ID UE _ID and the application server identifier. LI ^; _P.

In a particular embodiment, the calculation module 203 is in particular arranged to verify that it has calculated a key intended to secure a communication between a user equipment and an application server, this verification conditioning the sending to the user equipment of hazard. This check includes in particular a consultation of the storage memory 205.

In a particular embodiment, the authentication server comprises a module arranged to expose the UE_AF_Comm service, as described above.

It is emphasized here that the authentication server 20 also comprises other processing modules, not shown in FIG. 4, arranged to implement the different functions of this authentication server.

Figure 5 schematically illustrates an application server 40 in a particular embodiment.

The application server 40 comprises in particular:

a processor 400 for executing code instructions of software modules;

a communication module 401, forming a communication interface with a mobile communication network, arranged to communicate with devices of a communication network, for example with a user equipment and an authentication server;

a memory zone 404, arranged to store a program which comprises code instructions for implementing steps of the determination method;

a storage memory 405, designed to store data used during the implementation of the determination method.

The application server 40 also comprises:

a module 402 for determining a network identifier, arranged to determine from an access request Ml received from a user equipment a network identifier;

a connection module 403, arranged to establish a secure communication with the user equipment 10 by means of a key K _AF .

The communication module 401 is in particular arranged to receive an access request Ml sent by the user equipment and to send a request M2 to the authentication server 20 of the communication network of the identified operator. The module communication 401 is also arranged to receive a key K _AF for securing communication with the user equipment.

In a particular embodiment, the communication module 401 is arranged to receive from the authentication server a prepared proof for the user equipment 10 and to send this proof to the user equipment 10 in response to the request of Ml access sent by the user equipment.

In a particular embodiment, the application server 40 further comprises a calculation module, arranged to derive two keys K _AFenc for encryption and K _{AI ml} for integrity protection from K ^.

In a particular embodiment, the storage memory 405 is arranged to store in association with the user identifier UE _ro the key K _AF .

In a particular embodiment, the application server comprises a module arranged to expose the UE_AF_Comm service, as described above.

It is emphasized here that the application server 40 also comprises other processing modules, not shown in FIG. 5, arranged to implement the various functions of this application server.

The technique of determining a key is implemented by means of software and / or hardware components. In this context, the term "module" may correspond in this document to both a software component, a hardware component or a set of hardware and / or software components, capable of implementing a function or a set of functions, as described above for the module concerned.

A software component corresponds to one or more computer programs, one or more subroutines of a program, or more generally to any element of a program or software. Such a software component is stored in memory and then loaded and executed by a data processor of a physical entity and is able to access the hardware resources of this physical entity (memories, recording media, communication buses, electronic cards of a physical entity). input / output, user interfaces, etc.).

In the same way, a material component corresponds to any element of a material set (or hardware). It may be a programmable hardware component or not, with or without an integrated processor for running software. This is for example an integrated circuit, a smart card, an electronic card for executing a firmware, etc.

In a particular embodiment, the modules 101, 102, 103, 104 are arranged to implement steps of the determination method described above, implemented by the user equipment. These are preferably software modules comprising software instructions for executing those of the steps (or actions) of the determination method described above, implemented by a user equipment. The invention therefore also relates to: a program for a user equipment, comprising program code instructions intended to control the execution of those of the steps (or actions) of the determination method described above, when said program is executed by this user equipment;

- a recording medium readable by a user equipment on which is recorded the program for a device.

In a particular embodiment, the modules 201, 202, 203 are arranged to implement steps of the determination method described above, implemented by the authentication server. These are preferably software modules comprising software instructions for executing those of the steps (or actions) of the determination method described above, implemented by an authentication server. The invention therefore also relates to:

a program for an authentication server, comprising program code instructions intended to control the execution of those of the steps (or actions) of the determination method described above, when said program is executed by this authentication server; ;

a recording medium readable by an authentication server on which the program for a server is recorded.

In a particular embodiment, the modules 401, 402, 403 are arranged to implement steps of the determination method described above, implemented by the application server. These are preferably software modules comprising software instructions for executing those of the steps (or actions) of the determination method described above, implemented by an application server. The invention therefore also relates to:

a program for an application server, comprising program code instructions intended to control the execution of those of the steps (or actions) of the determination method described above, when said program is executed by this application server;

a recording medium readable by an application server on which the program for a server is recorded.

The software modules can be stored in or transmitted by a data carrier. This may be a hardware storage medium, for example a CD-ROM, a magnetic diskette or a hard disk, or a transmission medium such as an electrical signal, optical or radio, or a telecommunications network. Annex

Authentication Server Function (AUSF)

Access and Mobility Management Function (AMF)

- Data Network (DN), for example operator services, access to the extended communication network or third-party services

Network Exposure Function (NEF)

NF Repository Function (NRF)

Network Slice Function Selection (NSSF)

- Policy Control Function (PCF)

Session Management Function (SMF)

Unified Data Management (UDM)

User Plane Function (UPF)

Function Application (AF)

- User Equipment (EU)

(Radio) Access Network ((R) AN)

Claims

A method of determining a key for securing communication between a user equipment (10) and an application server (40), said method comprising:

an authentication (El) of the user equipment by an authentication server (20) of a mobile communication network, a secret master key being generated during said authentication by the user equipment and the authentication server; ;

- A sending (E4) by the user equipment to the authentication server of a key request to communicate with the application server;

a calculation (E5) of said key by means of a key derivation function applied to at least one randomness, a user identifier and an identifier of the application server by using the master key, said random having been received by the user equipment of the authentication server.

2. Determination method according to claim 1, wherein said authentication is triggered during a registration of the user equipment with the mobile communication network.

3. Determination method according to claim 1, wherein the user equipment sends (E2) to the application server an access request and receives from the application server a proof prepared by the authentication server and intended for the user equipment. , a verification (E3) of said proof by the user equipment conditioning the sending of the key request.

an authentication (Gl) of the user equipment by an authentication server (20) of a mobile communication network, a secret master key being generated during said authentication by the user equipment and the authentication server; ;

a receipt (G3) by the authentication server of a key request sent by the user equipment to communicate with the application server;

- a sending (G3) by the authentication server to the user equipment of a hazard;

a calculation (G2) of said key by means of a key derivation function applied to at least the random element, a user identifier and an identifier of the application server using the master key.

5. Determination method according to claim 4, wherein the authentication server provides (G2) to the application server prepared evidence to the user equipment, said proof being intended to be sent by the application server to the equipment. user in response to an access request sent by the user equipment, a verification of said proof by the user equipment conditioning the sending of the key request to the authentication server.

6. Determination method according to claim 4, wherein the authentication server verifies (G3) that it has calculated a key intended to secure a communication between said user equipment and said application server, said verification conditioning the sending to the user. user equipment of the hazard.

User equipment (10), arranged to communicate with an application server (40) via a mobile communication network, said equipment comprising:

an authentication module (102) of the user equipment by an authentication server (20) of the mobile communication network, a secret master key being generated during said authentication by the user equipment and the server of authentication;

- a sending module (101) by the user equipment to the authentication server of a key request to communicate with the application server;

a module (103) for calculating a key intended to secure a communication between the user equipment and the application server by means of a key derivation function applied to at least one randomness, a user identifier and a identifier of the application server using the master key, said hazard having been received by the user equipment of the authentication server.

An authentication server (20) of a mobile communication network, said authentication server comprising:

an authentication module (202), arranged to authenticate a user equipment, a secret master key being generated during said authentication by the user equipment and the authentication server;

a module (201) for receiving a key request sent by the user equipment to communicate with an application server;

- a sending module (201) by the authentication server to the user equipment of a hazard;

a module (203) for calculating a key intended to secure a communication between the user equipment and the application server, said key being calculated by means of a key derivation function applied to at least the random, a user ID and an identifier of the application server using the master key.

9. System (1) for determining a key for securing communication between a user equipment (10) and an application server (40), said system comprising at least one user equipment according to claim 7 and an authentication server according to claim 8.

Program for a user equipment, comprising program code instructions for controlling the execution of the steps of the determination method according to one of claims 1 to 3 implemented by the user equipment, when said program is executed. by said equipment.

11. Recording medium readable by a user equipment on which the program according to claim 10 is recorded.

12. Program for an authentication server, comprising program code instructions for controlling the execution of the steps of the determination method according to one of claims 4 to 6 implemented by the authentication server, when said program is executed by said server.

13. Recording medium readable by an authentication server on which the program according to claim 12 is recorded.